MCAUSER configured for RCVR channel is not being used to verify Put Authority

Technote (troubleshooting)

Problem(Abstract)

You have MCAUSER configured for your RCVR (receiver) channel, but messages XMIT'ed (transmitted) from the SDR channel are being put to the queue manager's dead letter queue (DLQ) instead of the target queue.

The MQDEAD message on the DLQ reports a reason MQRC_NOT_AUTHORIZED (2035, 0x7F3), which indicates that the user id does not have the proper authority.

When Put Authority is set to 'Context' for the RCVR channel the following is true:

"The user ID used to check open authority on the queue for MQOO_SET_ALL_CONTEXT and MQOO_ALTERNATE_USER_AUTHORITY is that of the process or user running the MCA at the receiving end of the message channel. The user ID used to check open authority on the queue for MQOO_OUTPUT is the UserIdentifier in the message descriptor."

Cause

Whenever a MQ application issues an MQOPEN call it will pass with it a set of MQ Open Options (MQOO_*). One such option is MQOO_OUTPUT, which tells the queue manager that you want to open the object for output. This allows a message to be PUT onto the Q. When using MQOO_OUTPUT, the queue manager will check the default user id for PUT authority to said Q. In the case that you have MCAUSER set on your RCVR channel, the default user id is the MCAUSER.

Because you have Put Authority set to 'Context' (CTX), however, the behavior and thus the MQOO (open options) are different. With CTX set, MQOO_ALTERNATE_USER_AUTHORITY is also passed during the MQOPEN call. What this means is that the UserIdentifier in the message descriptor (originates with the user id used to create the message) is copied to the AlternateUserId field of the object descriptor. Because MQOO_ALTERNATE_USER_AUTHORITY is set the queue manager will use the user id in the AlternateUserId field to authenticate PUT authority. This is why the queue manager is checking PUT authority for the user which is in the message descriptor's UserIdentifier field and not the MCAUSER.

Resolving the problem

If you want the MCAUSER to be used to verify PUT authority to the target queue, change Put Authority on the RCVR channel to 'Default' ( PUTAUT(DEF) ).

Example Trace Analysis: From the trace file for the queue manager's agent process (amqzlaa0.exe) reports that 'testuser' does not have PUT authority for queue 'A.LQ'. I'm including the pertinent section from the trace file below.

From the DLH (dead letter header) you see that the MQDEAD message was created for reason MQRC_NOT_AUTHORIZED' (2035, F3 07 byteswapped = 0x7F3).

All of this points to the user 'testuser' not having PUT authority for queue 'A.LQ'. Do you have Put Authority set to 'Context' for your RCVR channel 'TESTUSER.TO.QM1'? One way to check this is to issue the following MQSC (runmqsc) command from a command line: